CN104318134B - A kind of data guard method - Google Patents
A kind of data guard method Download PDFInfo
- Publication number
- CN104318134B CN104318134B CN201410617318.4A CN201410617318A CN104318134B CN 104318134 B CN104318134 B CN 104318134B CN 201410617318 A CN201410617318 A CN 201410617318A CN 104318134 B CN104318134 B CN 104318134B
- Authority
- CN
- China
- Prior art keywords
- arithmetic logic
- register
- compiler
- look
- encryption
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
- G06F21/125—Restricting unauthorised execution of programs by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Multimedia (AREA)
- Technology Law (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Devices For Executing Special Programs (AREA)
Abstract
This application discloses a kind of data guard method, including：Application program to be protected is compiled, corresponding compiler is obtained；To the corresponding arithmetic logic of distributor in the compiler, it is encrypted by the way of register encryption；The distributor is the register for preserving intermediate calculation results；According to default cut capacity N, to encryption after the compiler carry out computing cutting, N >=2；It is the corresponding arithmetic logic code of each register in the compiler by being obtained after computing cutting, corresponding look-up table is generated respectively, corresponding arithmetic logic is replaced using the look-up table, wherein, the corresponding distributor of operational parameter in the arithmetic logic being replaced is designated as under the look-up table.The security of computer applied algorithm can be effectively improved using the present invention.
Description
Technical field
The present invention relates to Technology On Data Encryption, more particularly to a kind of data guard method of computer applied algorithm.
Background technology
At present, in order to ensure the security of computer applied algorithm is, it is necessary to carry out virtualization process to application program, utilize
The arithmetic logic of program complicates or hides arithmetic logic to improve the difficulty that program code is illegally accessed.Conventional is virtual
Change means have：The fractionation of logical operation, equivalent transformation and the mode such as table look-up.
Wherein, the fractionation of logical operation and equivalent transformation are that concealing program fortune is reached by complicating arithmetic logic
Calculate the purpose of logic.The fractionation of logical operation is that arithmetic logic is split into more basic computing to improve arithmetic logic expression
Complexity.For example, for XOR XOR, 6 NAND operation NAND can be split into.The equivalent transformation of logical operation is
Being added in logical operation can obtain the blending parameter of equivalent result.For example, for A+2, can be with equivalent transformation as A+5-3.
Table look-up, be the mapping table that operational parameter and operation result are set up by the arithmetic logic previously according to program, right
When application program carries out virtualization process, the mapping table is introduced, real arithmetic logic is substituted using mapping table, according to specific
Operational parameter inquires about the mapping table, you can obtain corresponding operation result, so as to reach the purpose of hiding arithmetic logic.
The fractionation of above-mentioned logical operation and equivalent transformation scheme, although can complicate arithmetic logic, but due to only
It is replacement or the increase of basic arithmetic logic, and these basic arithmetic logics are (such as add, the NAND) being easily identified,
After basic operation is identified, original arithmetic logic counter can be released by the flow of some mechanizations, so as to cause by
The program of register encryption still can be illegally accessed in the short period of time.
Above-mentioned table look-up schemes, although arithmetic logic is hidden, but, specific operational parameter is exist, based on many
Group operational parameter and the corresponding relation of operation result, easily deduce corresponding arithmetic logic.In addition, table look-up schemes are also present taking
The excessive problem of memory space.Memory space shared by every form is equal to the span and operation result of operational parameter
Span product, such as when operational parameter and operation result are 32 integers, the size of table is 234Byte, this is in reality
On be unacceptable.
As can be seen here, there is the security that cannot effectively ensure application program in existing virtualization means.
The content of the invention
In view of this, it is a primary object of the present invention to provide a kind of data guard method, the method can be effectively improved
The security of computer applied algorithm.
In order to achieve the above object, technical scheme proposed by the present invention is：
A kind of data guard method includes：
A, application program to be protected is compiled, obtains corresponding compiler；
B, to the corresponding arithmetic logic of distributor in the compiler, added by the way of register encryption
Close treatment；The distributor is the register for preserving intermediate calculation results；
C, according to default cut capacity N, to encryption after the compiler carry out computing cutting, the N >=
2；
D, the corresponding arithmetic logic code of each register to be obtained after computing is cut in the compiler, point
Do not generate corresponding look-up table, corresponding arithmetic logic replaced using the look-up table, wherein, be designated as under the look-up table by
The corresponding distributor of operational parameter in the arithmetic logic of replacement.
In sum, data guard method proposed by the present invention, by integrating register encryption method, computing cutting and looking into
The methods such as table generation are looked for be encrypted program code so that intermediate results of operations is stored by the way of ciphertext,
The security of computer applied algorithm can be effectively improved.
Brief description of the drawings
Fig. 1 is the schematic flow sheet of the embodiment of the present invention one.
Specific embodiment
It is right below in conjunction with the accompanying drawings and the specific embodiments to make the object, technical solutions and advantages of the present invention clearer
The present invention is described in further detail.
Core concept of the invention is：Based on the virtual method tabled look-up, before arithmetic logic is converted into form, first
Carry out register encryption so that the parameter in table corresponding to operation result is by the parameter after encryption, so that can
To improve the validity that mapping form hides arithmetic logic.In addition, in order to avoid every form takes a large amount of memory spaces, in life
Into before form, first arithmetic logic is cut, obtain some sub- arithmetic logics, it is then corresponding to each sub- arithmetic logic generation again
Form, such that it is able to avoid memory space requirements it is excessive caused by the problem that cannot be applied.
Fig. 1 is the schematic flow sheet of the embodiment of the present invention one, as shown in figure 1, the embodiment mainly includes：
Step 101, application program to be protected is compiled, obtains corresponding compiler.
This step, can be virtualized the compilation tool realization that platform is recognized, it is preferred that can adopt using existing
It is compiled with Virbox compilers.
Step 102, to the corresponding arithmetic logic of distributor in the compiler, by the way of register encryption
It is encrypted.
The distributor is the register for preserving intermediate calculation results.
, it is necessary to be encrypted to the corresponding arithmetic logic of distributor in this step, in this way, can make to apply journey
The intermediate calculation results of sequence are preserved by the way of ciphertext, such that it is able to improve the security intensity of application program.
One arithmetic logic can be encrypted using existing register encryption method in this step.
It is preferred that the reliability in order to improve encryption, can use and decryption computing is inserted behind the instruction of read register
Instruction, the mode that cryptographic calculation instruction is previously inserted into the instruction for writing register, carry out the encryption.
For example, for source code：R1=i+7, is that, to write-in content i+7 in register R1, corresponding encryption is：
R1=enc (i+7)；Wherein, enc () is an enciphering transformation instruction.
It is to read register R1 contents to do subtraction with 5 for source code i=R1-5, corresponding encryption is：i
=dec (R1) -5；Wherein, dec () is a decryption transformation instruction.
For source code R1+=7, be during register R1 contents is read done with 7 and write again after addition R1, it is corresponding plus
Close treatment is R1=enc (dec (R1)+7).
Preferably, it is possible to use various register AESs are encrypted, i.e., above-mentioned enc (), dec () can be with
Determined using multiple encryption algorithms, can be specifically：The corresponding arithmetic logic of each distributor in the compiler,
By the way of a kind of encryption method is randomly choosed from default register AES, place is encrypted to the arithmetic logic
Reason.So, the encryption method that the corresponding arithmetic logic of different registers is used will likely be different, even if cracked a kind of adding solving
It is close be also impossible to it is similar shift other codes onto, such that it is able in order to further improve the reverse difficulty of program code after encryption
Degree.
Step 103, according to default cut capacity N, to encryption after the compiler carry out computing cutting.
Specifically, above-mentioned computing cutting includes：
The corresponding arithmetic logic code of each register in the compiler after for encryption, according to default
Cut capacity N, equivalent N number of sub- arithmetic logic code is cut into by the arithmetic logic code.
Here, the arithmetic logic that N number of sub- arithmetic logic code is realized will be equivalent with former arithmetic logic code.Specifically
Ground, how the method that an arithmetic logic code is cut into equivalent N number of sub- arithmetic logic code, be those skilled in the art institute
Grasp, will not be repeated here.
, it is necessary to carry out computing cutting to the compiler after encryption in this step, so, on the one hand, fortune can be made
Calculation logical expression form is more complicated, improves the difficulty that program code is inversely obtained, on the other hand tearing open by arithmetic logic
Point, reduce the length of operational parameter, will " width " arithmetic logic be converted into the arithmetic logic of multiple " narrow ", such that it is able to keep away
Exempt from further to generate problem excessive to memory space requirements during corresponding look-up table in subsequent step so that hereafter can combine
Look-up table further improves the difficulty that program code is inversely obtained, it is ensured that the security of program code.
For example：As N=2, can be converted into for (ushort) result=(ushort) a+ (ushort) imm following
Two sub- arithmetic logic codes：
(LoByte) result=(LoByte) a+ (LoByte) imm；(preserving addition carry mark CF)
(HiByte) result=(HiByte) a+ (HiByte) imm+CF.
It can be seen that, the length of the operational parameter involved by every sub- arithmetic logic code is before cutting 1/2, so, hereafter
When further to every sub- arithmetic logic code building look-up table, required memory space will be no longer huge to cannot specifically answer
With, such that it is able to be further combined with lookup table schemes, the security of raising code.
The specific value of the N, can be needed to be configured, as long as can meet by those skilled in the art according to actual operation
The memory space of look-up table generation needs in subsequent step.
Step 104, it is by the corresponding arithmetic logic of each register that obtains after computing cutting in the compiler
Code, generates corresponding look-up table, and corresponding arithmetic logic is replaced using the look-up table, wherein, the subscript of the look-up table
It is the corresponding distributor of operational parameter in the arithmetic logic that is replaced.
Here, the subscript of look-up table is the index entry of look-up table.
This step, for computing to be cut after the arithmetic logic code that preserves in each register for obtaining replace with it is equivalent
Look-up table, so, actual arithmetic logic is hidden by look-up table, can further improve the security of program code.
Here, the generation method of look-up table is compared with system, except that, this step is carried out to distributor
The replacement of the arithmetic logic carried out on the basis of encryption, so, because intermediate calculation results are always ciphertext, then is made with ciphertext
It is the subscript of look-up table, it will be difficult to look-up table is carried out inversely, drawing the arithmetic logic of program code again, so that final place
The program code that reason is obtained has security intensity very high.
From above-mentioned technical proposal it can be seen that the present invention is by integrating, register encryption method, look-up table are generated, computing is cut
The method such as cut to be encrypted the intermediate parameters of program code, can effectively ensure the Information Security of program code.Under
Face combines the processing procedure of a specific procedure code, and the present invention is further elaborated.
It is assumed that use Virbox compilation tools, it is necessary to treatment source code for：Int result=((input^
0x3B6217D9)>>1)+0xF834；
First, using Virbox compilation tools, source code is compiled, obtains following result：
R0=input
R1=R0^0x3B6217D9
R2=R1>>1
R3=R2+0xF834
Result=R3
Then, to compiling result register encryption, the code after following encryptions：
R0=input
E0=enc (R0^0x3B6217D9)
E1=enc (dec (E0)>>1)
R3=dec (E1)+0xF834
Result=R3
3rd, computing cutting is carried out to the code after above-mentioned encryption,
R0=input
E00=enc (r00^0xD9)
E01=enc (r01^0x17)
E02=enc (r02^0x62)
E03=enc (r03^0x3B) // 1 32 bit manipulations are split as 48 bit manipulations, wherein e00, e01, e02 above,
E03 is respectively corresponding 48 bit positions of above-mentioned E0, and r00, r01, r02, r03 are corresponding 48 bit positions of R0.
E13=enc (dec (e03)>>1) // 1 32 displacement bit manipulation are split as 48 bit manipulations.Each 8 bit manipulation meeting
One " carry flag " of setting, represents whether the position for removing is 1.
E12=enc (RCR1 (dec (e02))) //RCR1 is to move to right 1, and highest order is filled with " carry flag ".
E11=enc (RCR1 (dec (e01)))
E10=enc (RCR1 (dec (e00)))
R30=dec (e10)+0x34；// 32 additions are cut into 48 additions, and carry flag is set after each computing
R31=ADC (dec (e11), 0xF8)；// the addition with carry flag.
R32=ADC (dec (e12), 0)；
R33=ADC (dec (e13), 0)；
Result=R3；
Every sub- arithmetic logic code after being cut finally, for computing, according to the type and parameter of each 8 bit manipulation,
Each look-up table is generated, and generates the 4th phase targets code.
BYTE TableXorD9_Enc [256]={ ... }
BYTE TableDec_Shr1_Enc [256]={ ... }
BYTE TableDec_Adc00 [512]={ ... }
R0=input；
E00=TableXorD9_Enc [r00] // this table is exactly r=>The mapping of enc (r^0xD9)
E01=TableXor17_Enc [r01]
E02=TableXor62_Enc [r02]
E03=TableXor3B_Enc [r03]
E13=TableDec_Shr1_Enc [e03] // this table is r=>enc(dec(r)>>1) mapping
E12=TableDec_Rcr1_Enc [e02]
E11=TableDec_Rcr1_Enc [e01]
E10=TableDec_Rcr1_Enc [e00]
R30=TableDec_Add34 [e10]
R31=TableDec_AdcF8 [e11]
R32=TableDec_Adc00 [e12]
R33=TableDec_Adc00 [e13]
Result=R3
In sum, presently preferred embodiments of the present invention is these are only, is not intended to limit the scope of the present invention.
All any modification, equivalent substitution and improvements within the spirit and principles in the present invention, made etc., should be included in of the invention
Within protection domain.
Claims (4)
1. a kind of data guard method, it is characterised in that including：
A, application program to be protected is compiled, obtains corresponding compiler；
B, to the corresponding arithmetic logic of distributor in the compiler, be encrypted place by the way of register encryption
Reason；The distributor is the register for preserving intermediate calculation results；
C, for encryption after the compiler in the corresponding arithmetic logic code of each register, cut according to default
Density N is cut, the arithmetic logic code is cut into equivalent N number of sub- arithmetic logic code；N >=2；
D, the corresponding arithmetic logic code of each register to be obtained after computing is cut in the compiler, give birth to respectively
Into corresponding look-up table, corresponding arithmetic logic is replaced using the look-up table, wherein, it is designated as being replaced under the look-up table
Arithmetic logic in the corresponding distributor of operational parameter.
2. method according to claim 1, it is characterised in that the compiling is carried out using Virbox compilers in step a.
3. method according to claim 1, it is characterised in that used in step b and inserted behind the instruction of read register
Decryption operational order, the mode that cryptographic calculation instruction is previously inserted into the instruction for writing register, carry out the encryption.
4. method according to claim 1, it is characterised in that for being posted in the middle of each in the compiler in step b
The corresponding arithmetic logic of storage, it is right by the way of a kind of encryption method is randomly choosed from default register AES
The arithmetic logic is encrypted.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410617318.4A CN104318134B (en) | 2014-11-05 | 2014-11-05 | A kind of data guard method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410617318.4A CN104318134B (en) | 2014-11-05 | 2014-11-05 | A kind of data guard method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104318134A CN104318134A (en) | 2015-01-28 |
| CN104318134B true CN104318134B (en) | 2017-06-06 |
Family
ID=52373365
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410617318.4A Active CN104318134B (en) | 2014-11-05 | 2014-11-05 | A kind of data guard method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104318134B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107659399B (en) * | 2017-10-09 | 2021-02-23 | 四川巧夺天工信息安全智能设备有限公司 | Method for disguising and disguising characters based on non-repeated key |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1260055A (en) * | 1997-06-09 | 2000-07-12 | 联信公司 | Obfuscation techniques for enhancing software security |
| CN1275846A (en) * | 1999-05-26 | 2000-12-06 | 松下电器产业株式会社 | Device and method for data encipher |
| US7818552B2 (en) * | 2007-12-20 | 2010-10-19 | The United States Of America As Represented By The Secretary Of The Army | Operation, compare, branch VLIW processor |
| US8185749B2 (en) * | 2008-09-02 | 2012-05-22 | Apple Inc. | System and method for revising boolean and arithmetic operations |
| CN103324481A (en) * | 2013-06-26 | 2013-09-25 | 网宿科技股份有限公司 | Compiling method and compiling system for obfuscating codes by means of assembly |
| CN103699820A (en) * | 2013-12-25 | 2014-04-02 | 北京深思数盾科技有限公司 | Obfuscating method for relative jump instruction |
| CN104092535A (en) * | 2014-07-24 | 2014-10-08 | 福建升腾资讯有限公司 | Method for encrypting DES passwords |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7430670B1 (en) * | 1999-07-29 | 2008-09-30 | Intertrust Technologies Corp. | Software self-defense systems and methods |
-
2014
- 2014-11-05 CN CN201410617318.4A patent/CN104318134B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1260055A (en) * | 1997-06-09 | 2000-07-12 | 联信公司 | Obfuscation techniques for enhancing software security |
| CN1275846A (en) * | 1999-05-26 | 2000-12-06 | 松下电器产业株式会社 | Device and method for data encipher |
| US7818552B2 (en) * | 2007-12-20 | 2010-10-19 | The United States Of America As Represented By The Secretary Of The Army | Operation, compare, branch VLIW processor |
| US8185749B2 (en) * | 2008-09-02 | 2012-05-22 | Apple Inc. | System and method for revising boolean and arithmetic operations |
| CN103324481A (en) * | 2013-06-26 | 2013-09-25 | 网宿科技股份有限公司 | Compiling method and compiling system for obfuscating codes by means of assembly |
| CN103699820A (en) * | 2013-12-25 | 2014-04-02 | 北京深思数盾科技有限公司 | Obfuscating method for relative jump instruction |
| CN104092535A (en) * | 2014-07-24 | 2014-10-08 | 福建升腾资讯有限公司 | Method for encrypting DES passwords |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104318134A (en) | 2015-01-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104025104B (en) | The virtual machine facility obscured and method with key driving | |
| US9053300B2 (en) | Device and a method for generating software code | |
| EP3488553A1 (en) | Device and method for performing obfuscated arithmetic | |
| JP5167348B2 (en) | Software encryption method, software decryption method, software encryption device, and software decryption device | |
| CN111512307B (en) | Compiling apparatus and method | |
| US9928102B2 (en) | Method and apparatus for randomizing computer instruction sets, memory registers and pointers | |
| CN107346401A (en) | Information Guarantee System for safely configuration processor | |
| CN106156653A (en) | A kind of method and system of data storage | |
| US10331896B2 (en) | Method of protecting secret data when used in a cryptographic algorithm | |
| CN103279694B (en) | A kind of loading, guard method and device of file system | |
| CN113273131B (en) | Using a shared computing device | |
| CN112639774B (en) | Compiler device with masking function | |
| CN104463020B (en) | The method of memory data integrity protection | |
| CN106209346A (en) | Whitepack cryptographic technique is interlocked look-up table | |
| CN104318134B (en) | A kind of data guard method | |
| CN109558341A (en) | Calculator memory data guard method and computer | |
| Holl et al. | Whiteboxgrind–automated analysis of whitebox cryptography | |
| WO2019049217A1 (en) | System, modification device, method, and program | |
| NL2015955B1 (en) | Calculating device and method. | |
| US20170134379A1 (en) | Method for securing an application and data | |
| EP3238113B1 (en) | Hiding of a program execution | |
| WO2019059069A1 (en) | Secret reading/writing device, secret reading/writing method, and program | |
| Wouters et al. | Partial Key Overwrite Attacks in Microcontrollers: a Survey | |
| KR20200136315A (en) | Methods for implementing and obfuscating a cryptographic algorithm having a given secret key | |
| JP5378055B2 (en) | Program obfuscation apparatus, program obfuscation method, and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information |
Address after: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing Applicant after: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd. Address before: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing Applicant before: BEIJING SHENSI SHUDUN TECHNOLOGY Co.,Ltd. |
|
| COR | Change of bibliographic data | ||
| CB02 | Change of applicant information |
Address after: 100193 Beijing, Haidian District, East West Road, No. 10, East Hospital, building No. 5, floor 5, layer 510 Applicant after: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd. Address before: 100872 room 1706, building 59, Zhongguancun street, Haidian District, Beijing Applicant before: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd. |
|
| COR | Change of bibliographic data | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20181217 Address after: Room 602-43, 29 Building, 89 Garden Road, Jingjin Science and Technology Valley Industrial Park, Wuqing District, Tianjin 301700 (Centralized Office District) Patentee after: Reflections on Shudun (Tianjin) Technology Co.,Ltd. Address before: 100193 5th floor 510, No. 5 Building, East Yard, No. 10 Wangdong Road, Northwest Haidian District, Beijing Patentee before: BEIJING SENSESHIELD TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right | ||
| CP02 | Change in the address of a patent holder |
Address after: Room 103, Building 1, Yuntian Plaza, No. 30 Binhu Road, Wuqing Development Zone, Wuqing District, Tianjin 301799 Patentee after: Reflections on Shudun (Tianjin) Technology Co.,Ltd. Address before: Room 602-43, 29 Building, 89 Garden Road, Jingjin Science and Technology Valley Industrial Park, Wuqing District, Tianjin 301700 (Centralized Office District) Patentee before: Reflections on Shudun (Tianjin) Technology Co.,Ltd. |
|
| CP02 | Change in the address of a patent holder |